Surface host's Apple Business Manager (ABM) assignment

[marko-lisica]

Goal

User story
As an IT admin,
I want to see a timestamp and errors for the last time Fleet assigned a host's automatic enrollment profile
so that I can troubleshoot migration issues.

Changes

Product

• UI changes: Figma
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: Add docs for #39063 #40722 Updated 3/27/26 39063 - Updates to docs to use proper timestamp, ordering, keys #42561
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: [Guide] Enhance troubleshooting guidance for MDM enrollments #40326
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: Add docs for #39063 #40722
• Feature guide changes: [Guide] Enhance troubleshooting guidance for MDM enrollments #40326
• This is a premium only feature: Yes

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Risk level: Low

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

On Dashboard:

• If hosts with ABM issue > 0, confirm new "ABM issue" section is present with tooltip.
• On click navigates to filtered hosts with ABM issue.

On Hosts:

• if navigating from Dashboard:
  • "ABM issue hosts" pill shows at top indicating filtered list.
  • If you remove the pill, shows all hosts.
• "Status" tooltip is updated with currently supported devices.
• Host filter dropdown should have new item "Pending hosts".
  • when selected should allow "stacking" filters.
• Verify that Hosts list on Fleet Premium allows navigating to hosts page for Pending Apple MDM hosts(those known from ABM but not yet enrolled)
• Verify that Fleet Free does not show "Pending" hosts or give an option to navigate

On host details:
For ABM and non-ABM iPhone, iPad and Mac

• "MDM status" value is a link, without a tooltip, that opens the MDM status modal.
  • if dep_profile_error = true show error icon.
• Queries section removed for "pending" ABM hosts.
  • "MDM status" modal:
    • MDM status, value (tooltip), and view all hosts link on hover.
    • "Profile assignment" section with description. "Learn more" links to https://fleetdm.com/guides/apple-mdm-setup#troubleshooting.
    • "Profile assigned", "Profile pushed", and value of "Profile status" all have tooltips.
    • If dep_profile_error = true show row with "Profile assignment error". Value has error icon and tooltip. On hover, "View all hosts" goes to filtered host list that have same dep error.
  • MDM Status modal on Fleet Free shows up similar to non-Apple hosts on Fleet premium(no DEP details)
  • Make sure the modal appears correctly for MDM pending, off, manual, and company-owned
  • Make sure the modal appears correctly on Fleet Free and Fleet Premium when Apple MDM is disabled and when all MDMs are disabled, when the host does or does not have MDM on

non-Apple hosts:
For Windows/Android hosts:

• "MDM status" value is a link, without a tooltip, that opens the MDM status modal. No DEP details are present
• Modal appears and host page loads correctly on Fleet free and Fleet premium with MDM on or off

For Linux hosts:

• "MDM Status" does not appear
• Host page loads correctly on Fleet free and Fleet premium with MDM on or off

For the API:

• Test hitting the new contributor API 10, then 100, then 1000 times within a minute, waiting at least 10 minutes between hosts for one or more DEP-enabled hosts. Do you get ratelimited? Does the ratelimit seem to be so low that we need to document it? If so add a comment to the contributor API docs or if it is so low as to potentially impair UI usability alert in #g-mdm

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.